2

我正在尝试对 elastAlert 制定规则。

配置文件

rules_folder: example_rules


run_every:
  minutes: 1


buffer_time:
  minutes: 1


es_host: localhost


es_port: 9200


writeback_index: elastalert_status

alert_time_limit:
  days: 2

example_rules/example_frequency.yaml：

 name: Example rule


 type: frequency


 index: sample



 num_events: 1


 timeframe:
    hours: 4 


 filter:
 - term:
     message: "hi"


 alert:
 - "email"


 email:
 - "abc@example.com"

当我做 ：

GET sample/_search?q=*

我得到：

{
  "took": 1,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "failed": 0
  },
  "hits": {
    "total": 4,
    "max_score": 1,
    "hits": [
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "2",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:32:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "4",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T12:15:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "1",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:25:00",
          "message": "hi"
        }
      },
      {
        "_index": "sample",
        "_type": "blog",
        "_id": "3",
        "_score": 1,
        "_source": {
          "@timestamp": "2016-05-27T17:45:00",
          "message": "hi"
        }
      }
    ]
  }
}

但是当我这样做时 python -m elastalert.elastalert --verbose --rule example_frequency.yaml，我得到了这个：

    INFO:elastalert:Starting up
    INFO:elastalert:Queried rule Example rule from 2016-05-27 17:43 IST to 2016-05-27 17:44 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:43 IST to 2016-05-27 17:44 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
   INFO:elastalert:Queried rule Example rule from 2016-05-27 17:44 IST to 2016-05-27 17:45 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:44 IST to 2016-05-27 17:45 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
  INFO:elastalert:Queried rule Example rule from 2016-05-27 17:45 IST to 2016-05-27 17:46 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:45 IST to 2016-05-27 17:46 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds
  INFO:elastalert:Queried rule Example rule from 2016-05-27 17:46 IST to 2016-05-27 17:47 IST: 0 hits
    INFO:elastalert:Ran Example rule from 2016-05-27 17:46 IST to 2016-05-27 17:47 IST: 0 query hits, 0 matches, 0 alerts sent
    INFO:elastalert:Sleeping for 59 seconds

为什么它不起作用？它显示命中查询为 0。但为什么我不明白。

4

2 回答 2

3

使用“--es_debug_trace”可以像下面给出的示例一样提供帮助

python -m elastalert.elastalert --verbose --rule example_frequency.yaml --es_debug_trace /opt/elastalert/runtime.log

这可以帮助您查看实际触发的 cURL 命令以获取命中数。在这里，您可以查看用于搜索过滤器/查询/匹配的日期/时间范围。

在您的情况下，问题是@Val 在评论中提到的日期（IST 和 UTC）。

于 2016-07-19T07:11:00.693 回答
0

您需要在规则中配置时间戳（example_rules/example_frequency.yaml）

timestamp_field: "@timestamp"

并且可能：
   timestamp_type
   timestamp_format
->文档

除此之外，在您的情况下，您将通过这些配置获得最佳性能：
   use_count_query: true
   doc_type: blog
->文档

于 2016-05-27T13:55:08.057 回答